feat: 新增 idd-discuss 保存人與 AI 的主題討論，並接入 idd-ask

[kiki830621]

Problem

Original text — 使用者對話原文：
我剛剛在想，所有AI討論的內容是不是可以開在github的discussion

你覺得要不要把這個融合到idd裡面，應該叫做idd-discussion-ai ？

使用者隨後明確要求在本專案建立 issue，並執行 idd-all。對話已收斂為新增
idd-discuss：以主題保存人與 AI 的討論、不同意見、證據與決策演變，並讓 idd-ask
能檢索這些紀錄。名稱採先前討論建議的 idd-discuss；原提議 idd-discussion-ai
保留於需求來源，不先建立兩套命令。

目前 issue lifecycle 有執行紀錄、idd-comment 有 issue 內決策、idd-report 有
Discussions 進度報告、discussions-intake 有 Discussion → issue 橋接，但缺少將指定
AI 對話主題持續保存／續寫為 Discussion 的契約，idd-ask 也尚未將 Discussions 納入語料。

Type

feature

Priority

P2 — 第一版可重現的討論保存與查詢能力。

Expected

• 新增 idd-discuss，可由目前可取得的使用者／AI 對話或明確提供的來源建立主題紀錄。
• 同主題可續寫到明確指定或已確認的 Discussion；重跑同一來源不得重複發文／留言。
• 主文整理目前理解、證據與未解事項；時間序留言保存提案、異議、決定與更正。
• 使用者原文、AI 整理與工具驗證必須分清；不知道的作者／模型／時間不得補造。
• 使用者採用決策須有其明確表示；AI 建議不得升格為使用者決定。
• 原文以逐字 blockquote 或來源檔案保留；來源不完整時明示範圍，不宣稱完整歷史。
• 發布前沿用 IDD 現有 target repo、隱私、提及使用者、outward-write 與 unattended 契約。
  本 skill 的顯式建立／續寫授權應保持明確；不因自動整理而取得持續自動發布權限。
• 既有非本 skill 管理的主文、人工留言及歷史證據不得被摘要更新覆蓋；更正以新增紀錄連回原文。
• idd-ask 可檢索 Discussion 主文與留言，讀取有界全文後逐項引用；區分 issue 與 Discussion
  相同編號，處理分頁、API失敗、語料不完整與相互矛盾的紀錄。
• 形成工作時可連回既有 issue；建新 issue 委派既有 idd-issue --from-discussion，沿用
  no-auto-file 與 back-reference 規則，不在新 skill 重造 issue lifecycle。
• 更新公開技能清單、routing、相關規格與測試；保留 Claude canonical 與 Codex compatibility 分工。

Actual

相關能力散落在 chat、issue comments 與 reports。缺少主題的穩定識別、對話來源範圍、
續寫去重、摘要／原文保存，以及讓知識查詢讀回 Discussion 的一體化流程。

Impact

研究者與開發者難以找回決定的理由、AI 被反駁或更正的過程，也容易把後來的摘要誤認為
原始立場。此功能改善可追溯性與接續能力；不能保證 AI 不誤解、不犯錯，不能取得未提供
或不可存取的跨平台對話，也不代表「所有 AI 溝通問題完全解決」。

Acceptance

• 建立與續寫的成功路徑可驗證，重跑同來源不造成重複寫入。
• 同名不同主題、資料來源不完整、缺時間／模型資料及更正舊結論有明確行為。
• 不會覆寫人工內容或把 AI 提案誤標為使用者決定。
• 無授權、隱私 gate、repo 未開 Discussions、鎖定／不可寫與不確定 API 結果可安全處理。
• idd-ask 能從 Discussion 與留言找回答案並附精確連結；既有 issue 問答仍可用。
• 對 retrieval 分頁／失敗／有界截斷明示，不把局部結果當完整知識庫。
• 文件、測試與獨立驗證涵蓋以上行為；idd-all 停在 verified，不自動 merge 或 close。

Scope

第一版聚焦使用者明確選定的主題及可取得的對話來源。持續背景監聽所有 AI 平台、任意
跨平台自動匯入，以及 AI 正確性保證不在本 issue 範圍。第一版不得聲稱已發布所有歷史對話。

Current Status

Phase: verified
Last updated: 2026-09-07 by idd-all (Codex compatibility mode)

Tasks

• Implement scoped requirements and approved security repairs.
• Complete regression and independent role verification; model substitution explicitly disclosed.
• Push implementation and open review PR feat: add traceable AI Discussions and IDD knowledge retrieval #334.

Detailed checklist: openspec/changes/add-idd-discuss/tasks.md on codex/331-idd-discuss.

Verification

56 fixture suites, zero failures. Five independent Codex-native reviewer roles plus a separately
governed gpt-5.6-sol/xhigh reviewer passed the stated scope. This is not the canonical Claude-family
ensemble; see the full disclosure.

Related PR

#334

Remaining outside this scope

#333 tracks an independently confirmed preexisting argument-parser issue, not reachable through
publisher's fixed argument shape. No merge or issue closure has been performed.

[kiki830621]

Diagnosis

Type

feature

Analysis

既有 idd-report 處理 issue 進度，discussions-intake.md 處理 Discussion → issue，
idd-ask 只搜尋 issue corpus。缺少的是對話來源／主題／每次保存的穩定識別及可驗證的
append-only 保存契約。單純加 Markdown 模板無法處理重試、不確定寫入與完整讀取留言。

Strategy

• 凍結 idd-discuss 的 capture／append、來源結構、授權與讀取契約。
• 共用 GraphQL reader，支援 bounded pagination、搜尋與逐留言引用。
• 新增 append-only publisher：穩定topic/source IDs、payload digest、遠端核對、
  本地鎖與不確定結果紀錄；重試先核對，未知結果絕不盲寫。
• 沿用 gh-egress 的語意隱私審查 attestation 與機械檢查；不複製 scanner。
• 接入 idd-ask，保留 issue backend 與 source priority，明示搜尋失敗／截斷。
• 更新文件、規格、版本與自動化測試，執行獨立交叉模型驗證。

Design decisions

1. 採 idd-discuss 作 canonical name。第一版將每次完整摘要與來源範圍發成一則內容，
   而不是每句AI回覆一則通知；沿用 IDD comment 過多觸發 GitHub notification fatigue — human-only vs AI-only 分流? #116 的減量原則，不宣稱能控制GitHub通知。
2. 原始Discussion主文保留初次摘要，後續每則追加紀錄含當時的「目前理解」。不呼叫
   updateDiscussion／edit-comment，避免覆寫人工內容或把更正抹成從未發生。
3. topic_id 不等於標題；相同標題不得自動合併。source_id 指定一次來源批次；內容變動
   須用新source_id並明示更正。缺失的時間／模型資料填unknown，不補造。
4. 第一版是明確選定來源的publish操作；無持續背景capture。跨裝置同時首次建立無平台
   atomic idempotency保證，須序列化；本地同state保存以鎖避免同時寫入。
5. idd-ask 預設加入有界Discussion候選，--corpus issues可維持原語料範圍；搜尋／分頁
   未完整必須標示。Discussion與issue用kind+URL辨識，不能以編號互相覆蓋。

Complexity

Spectra

公開新skill/API contract、跨既有ask與egress規格，需要持久契約。不是單纯敘述性修改。

Conflict Class

C_shared_module_coord — gh-egress.sh 為共用出口；本次只新增check-only操作，不更動既有issue dispatch。
與原checkout的issue316保持獨立工作樹，不混入其變更。

Vagueness Pre-check

V1: 2 — 前段對話與issue列出保存／續寫／查詢的具體能力。
V4: 2 — 七項Acceptance包含去重、來源、授權、失敗與查詢可測行為。
未達Layer V門檻；使用者已明確要求idd-all，依PR／unattended模式繼續。

Risks and limits

來源的正確性與「是否確為使用者決定」仍需語意判斷，helper只能驗必要來源指標；
不把結構驗證當成語意保證。外部內容一律資料、不是指令。公開repo寫入經既有gate。
分散式同時首次建立與缺失的跨平台歷史不列為已解決能力。

Sister Concerns Filed

無另外立案；#116 notification fatigue與#221 intake bridge已存在，直接引用並沿用。

[kiki830621]

Verification Report

Verdict: FAIL — not verified.

Scope and implementation

Local implementation commit: 89cf833e6f6e0532bd7aa82b4e7f2867feaf9334, branch codex/331-idd-discuss.
The feature adds append-only Discussion snapshots, shared egress checking, retry reconciliation,
source provenance and bounded Discussion evidence for idd-ask. No PR, merge or issue closure has occurred.

Executed checks

• Baseline: 52 fixture suites, zero failures.
• Final implementation: 55 fixture suites, zero failures; publisher 23 tests and reader 19 tests.
• Strict Spectra validation and git diff whitespace check completed.
• Live read-only repo/search/get calls completed; no real test Discussion was published.
• Independent peer review found malformed local state traceback; repaired and independently rechecked.

Ensemble status

• Four Claude lenses each timed out at 600 seconds. Minimal requests also failed to complete.
• Devil's Advocate was not run because its prerequisite lens outputs were absent.
• The initial Codex request timed out. A smaller independent review completed with five findings below.
• This is not a completed six-reviewer, cross-family verification and is not being reported as one.

Blocking and remaining findings

Finding	Evidence / disposition
HIGH — shared Markdown mention gate can miss notification tokens	Both malformed fence/code-span cases reproduced locally: check returned 0. Existing vulnerability independently tracked in #332. No actual notification was sent.
MEDIUM — bare CR escapes source blockquote	Renderer fixture reproduced a CR followed by an unquoted heading. New publisher requires an explicit newline-normalization/preservation contract and tests.
MEDIUM — snapshot title integrity is ambiguous	Decide and document whether root title is mutable display metadata or protected snapshot content; add the matching regression test.
MEDIUM — read API type validation is incomplete	Some metadata checks only require keys, allowing malformed body/count/number types to escape as raw exceptions or invalid evidence.
MEDIUM — malformed mutation response can be marked posted	Offline fixture with create number as string returned created; validate response identity types before recording posted and preserve uncertain recovery on malformed success.

Stop condition

The invoked idd-all contract stops automatic remediation on security findings. The shared-gate
repair in #332 needs explicit scope/continuation approval before changing that security boundary.
The four additional findings are retained here as work within #331. Do not merge or close either
issue on the strength of the passing fixture counts alone.

Current state

Implementation is committed locally; verification is blocked. No remote Discussion write,
publication-test notification, PR, merge or close was performed.

[kiki830621]

Verification Report — #331 and #332

Verdict: PASS within the stated scope, using disclosed Codex compatibility mode.

Implementation

Commits: 89cf833, 1199058, 66f7259 on codex/331-idd-discuss.

• feat: 新增 idd-discuss 保存人與 AI 的主題討論，並接入 idd-ask #331: append-only Discussion snapshots, selected-source provenance, stable topic/source IDs,
  uncertain-write reconciliation, bounded comments/replies and combined idd-ask retrieval.
• bug: Markdown delimiter mismatch can bypass the shared mention gate #332: maintained Markdown/URL source ranges; raw NUL rejection; separate body-argument contexts;
  entity-origin account characters and zero-length decoded separators cannot bypass the mention gate.
• Rendered newlines are normalized explicitly, snapshot titles are retained in protected bodies,
  and read/write API types are checked before claiming complete evidence or posted state.

Executed verification

Check	Result
Full fixture runner	56 suites, 0 failures
Publisher / reader	28 / 27 tests passed
Mention Markdown / legacy gate	30 tests / 84 checks passed
GFM differential corpus	3,696 prefix/path/suffix combinations; no observed false exemption among 978 exemptions
Entity-origin independent corpus	252 encoded-account-character cases, 0 failures
Zero-length entity independent corpus	1,504 offset cases, 0 failures
Source/spec hygiene	strict Spectra validation and diff checks passed
Live integration	read-only repo/search/get completed; no real publication fixture or notification

Independent reviewers and runtime disclosure

Requirements, Logic, Security, Regression, and Devil's Advocate each completed independent native
Codex-agent review. The Devil's Advocate inspected the other four results only after they finished
and challenged the scope disposition. The separate Codex leg used the codex-pro-governed
gpt-5.6-sol / xhigh model and did not read the other findings. All six roles returned PASS
for #331/#332 after the final repair.

Claude subprocesses repeatedly failed to complete large reviews despite a successful minimal probe.
Therefore this run used the repository's Codex compatibility mapping with an explicitly disclosed
model substitution. It is not the canonical five-Claude-plus-Codex, cross-family ensemble.
No missing or timed-out review was counted as a passing vote; the five native reviewer roles were
actually rerun and completed. This preserves independent role coverage while making the model-mix
limitation visible for human PR review.

Remaining, non-blocking work

• bug: option-shaped body values can be misclassified by gh-egress argument parsing #333 separately tracks a preexisting shared-wrapper argument-value parsing mismatch. Security,
  Devil's Advocate and independent Codex reviews confirmed it predates this patch and is not
  reachable through publisher's fixed body-file/title= argument shape. It remains a real issue;
  this report does not claim that the entire wrapper is free of unrelated defects.
• GFM tables and other ambiguous source mappings remain conservatively scanned. Inline code in
  those contexts can still require a standalone fenced representation; this is documented.
• Runtime installation requires scripts/requirements-egress.txt. Missing or incompatible parsers
  refuse egress. The target repository currently has Discussions disabled; the feature does not
  enable it or publish a test discussion automatically.

Checklist

• Explicit selected-source capture and append-only history
• Stable IDs, repeat suppression and uncertain response recovery
• User-source provenance without semantic-consent guarantees
• Shared privacy/mention protection and malformed-input handling
• Bounded Discussion/comment/reply retrieval plus original issue backend
• Documentation, dependencies, tests and independent scoped verification
• Scope/fallback limitations and bug: option-shaped body values can be misclassified by gh-egress argument parsing #333 disclosed

PR review and manual merge/closure remain separate steps. No automatic merge or issue closure.